OnlyFans API Authentication

OnlyFans API authentication with ofapis is a single Bearer token — no OAuth redirect, no per-request signing, no HMAC. You create a key, send it on every request, and rotate it when needed. This page covers how the token works and how to keep it safe.

Create a token

Generate a key in the dashboard. Keys are prefixed ofapis_sk_ and the full value is shown once at creation, so copy it immediately into a secrets manager or environment variable. Never commit it to a repository or ship it in client-side code — anyone holding the token can act as your account.

Send it on every request

Pass the token in the Authorization header on every call to the base URL https://api.ofapis.com/api/public/v1:

curl https://api.ofapis.com/api/public/v1/me \
  -H "Authorization: Bearer ofapis_sk_..."

import os, requests

r = requests.get(
    "https://api.ofapis.com/api/public/v1/me",
    headers={"Authorization": f"Bearer {os.environ['OFAPIS_KEY']}"},
)
r.raise_for_status()
print(r.json())

A valid token resolves to your account, its plan limits, and its linked OnlyFans accounts. Handle these responses:

A 401 is never charged, so a bad token costs no credits.

Two credentials, don't confuse them

There are two distinct secrets in ofapis. The API token (ofapis_sk_...) authenticates you, the developer, to the public API. The OnlyFans session for each linked creator is held server-side and encrypted — you never see it or send it. You connect a creator account once in the dashboard; ofapis keeps that session alive with a dedicated proxy, so you authenticate to ofapis, not to OnlyFans.

Address multiple accounts

The token can reach every OnlyFans account you've linked. Scope a call to a specific creator with its accountId in the path:

curl https://api.ofapis.com/api/public/v1/accounts/acct_4Kd2/mailings \
  -H "Authorization: Bearer ofapis_sk_..."

Global routes (like /me) resolve to your first active account. See how to authenticate an OnlyFans account for the linking flow.

Rotate and revoke

Issue a separate token per service — chatbot, scheduler, dashboard — so you can revoke one without breaking the others. Rotate on a schedule, and revoke immediately if a key is exposed. Revocation takes effect at once; the next request with that token returns 401.

FAQ

Does OnlyFans API authentication use OAuth?

No. ofapis uses a static Bearer token you generate in the dashboard. There is no OAuth flow, refresh token, or request signing — you send Authorization: Bearer ofapis_sk_... on each call.

Do I ever handle OnlyFans login credentials in code?

No. You link each creator account once through the dashboard, and ofapis stores the encrypted session server-side. Your code only ever sends your ofapis API token.

What happens if my API token leaks?

Revoke it in the dashboard and issue a new one. Other tokens keep working, so a per-service key scheme lets you rotate one credential without downtime elsewhere.

Do failed authentication calls cost credits?

No. Only successful calls are metered at one credit each. A 401 from a missing or revoked token is never charged. See pricing.

Create a token free · Error codes · Python quickstart · API reference